{"id":2943228,"date":"2025-10-14T15:18:44","date_gmt":"2025-10-14T22:18:44","guid":{"rendered":"https:\/\/www.esri.com\/arcgis-blog\/?post_type=blog&p=2943228"},"modified":"2025-10-28T10:18:27","modified_gmt":"2025-10-28T17:18:27","slug":"understanding-arcgis-server-soe-compromise","status":"publish","type":"blog","link":"https:\/\/www.esri.com\/arcgis-blog\/products\/trust-arcgis\/administration\/understanding-arcgis-server-soe-compromise","title":{"rendered":"Understanding ArcGIS Server SOE Compromise"},"author":3911,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","format":"standard","meta":{"_acf_changed":false,"_searchwp_excluded":""},"categories":[37501],"tags":[24081,24071],"industry":[],"product":[36571,763582],"class_list":["post-2943228","blog","type-blog","status-publish","format-standard","hentry","category-administration","tag-ssamymlgp","tag-security","product-arcgis-enterprise","product-trust-arcgis"],"acf":{"short_description":"Overview of SOE compromise and how to ensure customer operations are not affected.","flexible_content":[{"acf_fc_layout":"content","content":"

On 10\/14\/25, Reliaquest (a security vendor) published a summary<\/a> about how an ArcGIS Server extension was made by a malicious actor to facilitate on-going persistence after initial compromise via other mechanisms.<\/p>\n

This issue does NOT affect ArcGIS customers by default, has been confirmed as an issue by only one customer, and requires multiple configuration steps not in alignment with best practices<\/em><\/strong>.<\/p>\n

Esri\u2019s incident response team worked with both the customer and the security organization to facilitate investigation efforts.\u00a0 While the initial write-up by Reliaquest mistakenly referred to internal Esri documentation updates being required, they subsequently updated it to suggest customers refer to our existing security best practices documentation, specifically, we recommend the ArcGIS Enterprise Hardening Guide<\/a> which is updated on a regular basis.<\/p>\n

What are the circumstances necessary for this to occur?<\/strong><\/p>\n

    \n
  1. The ArcGIS Server Manager interface was exposed for general Internet access \u2013 Customers should limit access to management interfaces by Internet users. As mentioned in our best practices, don\u2019t expose management interfaces to the Internet.<\/li>\n
  2. Multi-factor authentication (MFA) was not used \u2013 Exposing management interfaces and not utilizing MFA for user accounts should never be utilized as clarified in best practice documentation.<\/li>\n
  3. While logs were not available back to initial time of compromise, the above issues likely resulted in the malicious user\u2019s ability to administrate the ArcGIS Enterprise system and deploy a custom Server Object Extension (SOE).\u00a0 The SOE was NOT the initial source of compromise, but was instead utilized as the gateway for passing information and maintaining persistence in the system.\u00a0 Customers should regularly validate the security posture of their deployment as described in the best practices documentation \u2013 This includes ensuring there are no unexpected extensions\/plugins installed.<\/li>\n
  4. Last, but not least, the permissions of the ArcGIS Server service account were elevated to full administer\/root which was implemented by the customer as part of troubleshooting an issue, and the permissions were NOT returned to the defaults\/best practices. The SOE would have failed if the excessive permissions were not put in place.<\/li>\n<\/ol>\n

     <\/p>\n

    Bottomline, this case demonstrates that when a deployment implements numerous layers counter to best practices, a deployment may be compromised.\u00a0 <\/em><\/strong><\/p>\n

    The SOE specifically being used for passing traffic and as a persistence mechanism is novel, but implementing security best practices would have prevented this issue.\u00a0\u00a0 If some of the circumstances above seem familiar for your operations, you should immediately work on implementing the guidance within the ArcGIS Enterprise Hardening Guide.\u00a0 Bonus item, we also strongly recommend ensuring you have a Web Application Firewall (WAF) to further mitigate such risks and provide stronger awareness of attacks, which was also a basic component missing from the customer\u2019s deployment.<\/p>\n

     <\/p>\n

    Q&A<\/strong><\/p>\n

      \n
    1. What product(s) were affected?
      \n<\/strong><\/p>\n